Monitor EC2 Security Group Configuration Changes

Correct Answer: C.

Option A is incorrect because this option needs to configure a new Lambda function and trigger it periodically.

It is not the easiest option.

Option B is incorrect because, in the CloudTrail console, you cannot directly select the CloudWatch Log group and configure the CloudWatch alarm.

Option C is CORRECT because users can easily configure a metric filter with the filter pattern for the security group configuration changes and configure a CloudWatch alarm afterward.

Option D is incorrect because Amazon Athena should work with S3 for users to query data through standard SQL.

Athena doesn't perform such filter configuration.

Reference:

https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudwatch-alarms-for-cloudtrail.html#cloudwatch-alarms-for-cloudtrail-security-group

The correct answer is C. In the CloudWatch Log group, create a metric filter that defines the security group change events. Create a CloudWatch alarm with the metric filter.

Here's a detailed explanation for why C is the correct answer:

AWS CloudTrail is a service that enables governance, compliance, operational auditing, and risk auditing of your AWS account. It records AWS API calls and delivers log files to an S3 bucket, CloudWatch Logs group, and CloudWatch Events. CloudWatch is a monitoring service that provides data and actionable insights for AWS resources and the applications you run on them. It collects and tracks metrics, logs, and events, and enables you to monitor, troubleshoot, and take automated actions on your AWS resources.

When CloudTrail is enabled in your AWS Organization, it delivers events to a CloudWatch Log group. You can use CloudWatch Logs to store, monitor, and access your log files from EC2 instances, AWS services, and custom applications. You can also create metric filters and alarms to monitor specific log events and trigger automated actions based on predefined thresholds.

To monitor the configuration changes of EC2 security groups using CloudTrail logs and trigger a CloudWatch alarm, you can follow these steps:

1. Open the CloudWatch console at https://console.aws.amazon.com/cloudwatch/.
2. In the left navigation pane, choose Logs.
3. Choose the CloudWatch Logs group that receives CloudTrail logs from your AWS Organization.
4. Choose Create Metric Filter.
5. In the Filter Pattern section, choose the Custom pattern radio button and enter the following filter pattern:

javascriptCopy code
{ $.eventName = AuthorizeSecurityGroupIngress }  || { $.eventName = AuthorizeSecurityGroupEgress }  || { $.eventName = RevokeSecurityGroupIngress }  || { $.eventName = RevokeSecurityGroupEgress } 

This filter pattern matches any CloudTrail log event that contains one of the four EC2 security group change events: AuthorizeSecurityGroupIngress, AuthorizeSecurityGroupEgress, RevokeSecurityGroupIngress, and RevokeSecurityGroupEgress. You can modify this filter pattern to match your specific security group change events.

6. Choose Assign Metric and enter a name for your metric filter.
7. Choose Create Filter to create your metric filter.
8. Choose Create Alarm to create a CloudWatch alarm based on your metric filter.
9. In the Create Alarm wizard, configure your alarm settings, such as the alarm name, description, threshold, period, and notification actions.
10. Choose Create Alarm to create your CloudWatch alarm.

Once you create your CloudWatch alarm, it starts monitoring your CloudTrail logs for security group change events. When a security group change event occurs, CloudWatch triggers your alarm and sends a notification to your specified targets, such as an email address or an SNS topic. You can also configure your alarm to take automated actions, such as invoking an AWS Lambda function or sending a message to an SQS queue.